Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 03:26
General
- Target 2026-07-31_1df1cfc266d2a0b8b3091cc6e5fdbad0_akira_glassworm_icedid_quasar-rat_rusty-stealer.exe
- Size 23.1MB
- Sample260731-dzd7baam2x
- SHA256 d34519aeef308bc6c06e294f80ba1b2ce71dda881163b9d4ac2c7173a3e46663
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_1df1cfc266d2a0b8b3091cc6e5fdbad0_akira_glassworm_icedid_quasar-rat_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_1df1cfc266d2a0b8b3091cc6e5fdbad0_akira_glassworm_icedid_quasar-rat_rusty-stealer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\AccessibilityHub\AccessibilityHub.exe"C:\ProgramData\AccessibilityHub\AccessibilityHub.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 5283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 5563⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"cmd /c cd /d "C:\System Volume Information\Heat" && start "" "C:\ProgramData\AccessibilityHub\AccessibilityHub.exe""1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 5568 -ip 55681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5208 -ip 52081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AccessibilityHub.exe
Cache.pmt
uEmuQU32.dll
memory/1316-155-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-148-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-149-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-156-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-154-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-145-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-144-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-146-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-147-0x0000000010000000-0x0000000010281000-memory.dmp
memory/1316-143-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-98-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-103-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-97-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-99-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-100-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-96-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-101-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-83-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-84-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-85-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-86-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-88-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-94-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-95-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-89-0x0000000010000000-0x0000000010281000-memory.dmp
memory/3868-87-0x0000000010000000-0x0000000010281000-memory.dmp
memory/4204-40-0x0000000180000000-0x0000000180377000-memory.dmp
memory/4204-37-0x0000000180000000-0x0000000180377000-memory.dmp
memory/4204-39-0x0000000180000000-0x0000000180377000-memory.dmp
memory/4204-36-0x0000000180000000-0x0000000180377000-memory.dmp
memory/4204-38-0x0000000180000000-0x0000000180377000-memory.dmp
memory/4204-31-0x0000020C06B90000-0x0000020C06F03000-memory.dmp
memory/4204-27-0x0000000180000000-0x0000000180377000-memory.dmp
memory/4788-25-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/4788-24-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/4788-22-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/4788-26-0x0000000000400000-0x0000000000637000-memory.dmp
memory/4788-23-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/4788-21-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/4788-64-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/4788-20-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/4788-65-0x0000000000400000-0x0000000000637000-memory.dmp
memory/4788-12-0x0000000180000000-0x00000001808E1000-memory.dmp
memory/5208-126-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-114-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-113-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-116-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-117-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-118-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-122-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-121-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-119-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5208-115-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-42-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-41-0x0000000000C30000-0x0000000000EAB000-memory.dmp
memory/5568-54-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-59-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-60-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-56-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-55-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-53-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-52-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-51-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-50-0x0000000010000000-0x0000000010281000-memory.dmp
memory/5568-67-0x0000000010000000-0x0000000010281000-memory.dmp